Overview

overview

10

Static

static

3

3bbbe35744...18.exe

windows7-x64

10

3bbbe35744...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3bbbe357442ab2ea79afd033b49d8aa5_JaffaCakes118

  • Size

    730KB

  • Sample

    241012-yb821axgqh

  • MD5

    3bbbe357442ab2ea79afd033b49d8aa5

  • SHA1

    1ab8ab03b23acd0793b4c2343509e8bd4b2fe3b6

  • SHA256

    b22cb6ef510d4f74839019a820324fc5e8358f21872461c0e13b0bc21d9bb553

  • SHA512

    2596a63abc4402cbed5a4e6c3a1cf235dc38067520c1af541d3f2433713b2516c5954ac6727816c9fb53d8a640365178f5d952bd90dc63f59e30e2150d013c05

  • SSDEEP

    12288:dCMwwISofS4dhvcYe/XnMzzH+zPzKf0JH5by7CU72/8JsGUeUTPDUq09NWL:dCRwF74dhsXMzz+e8JZbqb7aKsGCPDV1

Score
10/10
cybergatevítimadiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.7 Beta 02

Botnet

vítima

C2

receptorpe1.no-ip.biz:80

receptorpe1.no-ip.biz:443
Mutex

222w2365wx7

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    QuickTime

  • install_file

    QlTask.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    spynet

  • regkey_hkcu

    QuickTime

  • regkey_hklm

    QuickTime

Targets

    • Target

      3bbbe357442ab2ea79afd033b49d8aa5_JaffaCakes118

    • Size

      730KB

    • MD5

      3bbbe357442ab2ea79afd033b49d8aa5

    • SHA1

      1ab8ab03b23acd0793b4c2343509e8bd4b2fe3b6

    • SHA256

      b22cb6ef510d4f74839019a820324fc5e8358f21872461c0e13b0bc21d9bb553

    • SHA512

      2596a63abc4402cbed5a4e6c3a1cf235dc38067520c1af541d3f2433713b2516c5954ac6727816c9fb53d8a640365178f5d952bd90dc63f59e30e2150d013c05

    • SSDEEP

      12288:dCMwwISofS4dhvcYe/XnMzzH+zPzKf0JH5by7CU72/8JsGUeUTPDUq09NWL:dCRwF74dhsXMzz+e8JZbqb7aKsGCPDV1

    Score
    10/10
    cybergatevítimadiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks